Slashdot Mirror

See subject - This is how STUPID you are on process scheduling (kernelmode vs. usermode) https://it.slashdot.org/comments.pl?sid=12003589&cid=56472075/

* RoTfLmAo!

CLUE again STUPID - hosts AVOID dns & its many security failings! Hosts get precedence by default (especially lately, Windows used to set the buggy cache below OVER hosts but a recent install here shows it is as I say now in the registry - MS got SMART) over remote DNS (slower) OR local DNS bolted on buggy bloat OR the faulty w/ large hosts files BUGGY dns slower usermode cache https://www.bishopfox.com/blog... (is that patched yet? NOT that I know of)

APK

P.S.=> Also again - WTF is a "false negative"? apk

See subject & a 255 subdomain limit - answer 2 questions: 1.) How much does 4 billion domains cost 2.) Does my approach work to STOP this threat??

CLUE: A botnet can't LOOKUP @ DNS for C&C if blocked in hosts (resolves locally prior to DNS & avoids Windows faulty w/ large hosts slower usermode dnscache service buggier on Win10 too https://www.bishopfox.com/blog/2017/10/a-bug-has-no-name-multiple-heap-buffer-overflows-in-the-windows-dns-client/ )

(Domains/subdomains in a 4++ billion RANGE? Prohibitive & poor ROI!)

APK

P.S.=> I don't spend a FORTUNE in comparison to botnet herders to stall this via DGA tracking lists & changing my hosts program .ini in APK Hosts File Engine 10++ 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ configurable, bulletproof & bugfree to date after 5++ yrs. now & yes, users like & USE my work (not yours)... apk

No DNS lookup needed. Hosts = 1st resolver & host-domain names used by botnet = BLOCKED in hosts nullifying need for remote DNS lookup as the IP address to hostname resolution was satisfied.

(or 2nd depending on TCP/IP registry setup & w/ large hosts I blow off buggy w/ large hosts faulty slower usermode clientside dnscache service (WORSE in Win10 w/ flaws https://www.bishopfox.com/blog/2017/10/a-bug-has-no-name-multiple-heap-buffer-overflows-in-the-windows-dns-client/ ))

* So if botnet clients ask for IP address of C&C(s) they can't go outbound OR GET INFO INBOUND either!

APK

P.S.=> I didn't need to deflect a DAMN THING except your unnecessary bullshit here which I did perfectly, lol... apk

Randomly generated or not, once a hostname is blocked in hosts, it's blocked & I've even shown Tepples there are DGA lists (where names are generated thus) & I use them - so much for that bs from you.

IF a domain is compromised, "good" or not? I will block it - you can easily do so too OR NOT, up to you.

Depends on the proxy used - Proximitron can use & work with hosts files.

By default hosts ARE THE 1st RESOLVER (unless you use the faulty with large hosts files LOCAL usermode slower dnscache client service which is even MORE BUGGY on Windows 10 https://www.bishopfox.com/blog/2017/10/a-bug-has-no-name-multiple-heap-buffer-overflows-in-the-windows-dns-client/

APK

P.S.=> Even BLEEPING COMPUTER agrees that vs. cryptominers like this one? HOSTS WORK "use this classic Windows hosts trick to block the Coinhive or Crypto-Loot domains at the OS level" https://www.bleepingcomputer.com/news/security/a-new-player-joins-coinhive-on-the-browser-cryptojacking-scene/ ... apk

See subject (Win7 = unaffected) https://www.bishopfox.com/blog/2017/10/a-bug-has-no-name-multiple-heap-buffer-overflows-in-the-windows-dns-client/

* I use hosts files combined w/ OpenDNS (patched vs. kaminsky redirect poisoning) vs. UNPATCHED remote DNS (99++% != patched)

I turn the service for it off (too small of a buffer to contain LARGE hosts files creating CPU overuse) & use this to UP priority of hosts over local dns clientside SLOWER USERMODE dnsapi.dll + over remote unpatched DNS servers:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\ServiceProvider]
"DnsPriority"=dword:00000006
"HostsPriority"=dword:00000005
"LocalPriority"=dword:00000007
"NetbtPriority"=dword:00000008

(LOWER = MORE PRIORITY)

APK

P.S.=> APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ ... apk

See subject (Win7 = unaffected) https://www.bishopfox.com/blog/2017/10/a-bug-has-no-name-multiple-heap-buffer-overflows-in-the-windows-dns-client/

* I use hosts files combined w/ OpenDNS (patched vs. kaminsky redirect poisoning) vs. UNPATCHED remote DNS (99++% != patched)

I turn the service for it off ( too small of a buffer to contain LARGE hosts files creating CPU overuse) & use this to UP priority of hosts over local dns clientside SLOWER USERMODE dnsapi.dll + over remote unpatched DNS servers:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\ServiceProvider]
"DnsPriority"=dword:00000006
"HostsPriority"=dword:00000005
"LocalPriority"=dword:00000007
"NetbtPriority"=dword:00000008

(LOWER = MORE PRIORITY)

APK

P.S.=> APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ ... apk

Has MS patched dnsapi.dll for Win8-10 (local DNS cache = bad)? Win7 = unaffected (best one & why I use it) https://www.bishopfox.com/blog/2017/10/a-bug-has-no-name-multiple-heap-buffer-overflows-in-the-windows-dns-client/

* Anyone wonder WHY I use hosts files in combination w/ OpenDNS (patched vs. kaminsky redirect poisoning) vs. UNPATCHED remote DNS or unpatched ISP dns (99++% aren't patched vs. kaminsky redirect poisonings)?

Don't wonder why after reading the above...

APK

P.S.=> For more speed, security, reliability & anonymity online accept NO substitute for APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ ... apk